https://community.splunk.com/t5/Getting-Data-In/How-to-breakdown-JSON-data-with-escape-characters-from-events/m-p/482184#M82624 <P>Hey all,<BR /> I have recently structured and extracted some data from a REST API and stored the data in an index. Now the problem is, I have one field in this data which was extracted as its original JSON structure from the API and now it looks like this in one of my events:</P> <PRE><CODE>threshold_values="{\"thresholdLevels\": [{\"severityValue\": 4, \"severityLabel\": \"medium\", \"severityColor\": \"#FCB64E\", \"severityColorLight\": \"#FEE6C1\", \"thresholdValue\": 0, \"dynamicParam\": 0}, {\"severityValue\": 3, \"severityLabel\": \"low\", \"severityColor\": \"#FFE98C\", \"severityColorLight\": \"#FFF4C5\", \"thresholdValue\": 5, \"dynamicParam\": 0}, {\"severityValue\": 2, \"severityLabel\": \"normal\", \"severityColor\": \"#99D18B\", \"severityColorLight\": \"#DCEFD7\", \"thresholdValue\": 19, \"dynamicParam\": 0}], \"baseSeverityColorLight\": \"#E3F0F6\", \"baseSeverityColor\": \"#AED3E5\", \"gaugeMin\": 0, \"renderBoundaryMin\": 0, \"isMaxStatic\": false, \"baseSeverityValue\": 1, \"metricField\": \"count\", \"isMinStatic\": true, \"gaugeMax\": 20.9, \"baseSeverityLabel\": \"info\", \"renderBoundaryMax\": 100}" </CODE></PRE> <P>Now my objective is to break down this field into multiple fields of SeverityLabel and SeverityValue and extract their corresponding values. This should be done for all of my events which follow a similar structure.</P> <P>Please help I am new to Splunk<BR /> Thank you.</P> Mon, 16 Sep 2019 01:12:06 GMT pkol 2019-09-16T01:12:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-breakdown-JSON-data-with-escape-characters-from-events/m-p/482184#M82624 <P>Hey all,<BR /> I have recently structured and extracted some data from a REST API and stored the data in an index. Now the problem is, I have one field in this data which was extracted as its original JSON structure from the API and now it looks like this in one of my events:</P> <PRE><CODE>threshold_values="{\"thresholdLevels\": [{\"severityValue\": 4, \"severityLabel\": \"medium\", \"severityColor\": \"#FCB64E\", \"severityColorLight\": \"#FEE6C1\", \"thresholdValue\": 0, \"dynamicParam\": 0}, {\"severityValue\": 3, \"severityLabel\": \"low\", \"severityColor\": \"#FFE98C\", \"severityColorLight\": \"#FFF4C5\", \"thresholdValue\": 5, \"dynamicParam\": 0}, {\"severityValue\": 2, \"severityLabel\": \"normal\", \"severityColor\": \"#99D18B\", \"severityColorLight\": \"#DCEFD7\", \"thresholdValue\": 19, \"dynamicParam\": 0}], \"baseSeverityColorLight\": \"#E3F0F6\", \"baseSeverityColor\": \"#AED3E5\", \"gaugeMin\": 0, \"renderBoundaryMin\": 0, \"isMaxStatic\": false, \"baseSeverityValue\": 1, \"metricField\": \"count\", \"isMinStatic\": true, \"gaugeMax\": 20.9, \"baseSeverityLabel\": \"info\", \"renderBoundaryMax\": 100}" </CODE></PRE> <P>Now my objective is to break down this field into multiple fields of SeverityLabel and SeverityValue and extract their corresponding values. This should be done for all of my events which follow a similar structure.</P> <P>Please help I am new to Splunk<BR /> Thank you.</P> Mon, 16 Sep 2019 01:12:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-breakdown-JSON-data-with-escape-characters-from-events/m-p/482184#M82624 pkol 2019-09-16T01:12:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-breakdown-JSON-data-with-escape-characters-from-events/m-p/482185#M82625 <P>try this:</P> <PRE><CODE>|rex field=_raw "severityValue\\\+\"+\:(?&lt;sev_val&gt;.*?)\,+\s+\\\+\"+severityLabel\\\+\"+\:+\s+\\\+\"+(?&lt;sev_label&gt;.*?)\\\+" max_match=0 </CODE></PRE> Mon, 16 Sep 2019 11:09:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-breakdown-JSON-data-with-escape-characters-from-events/m-p/482185#M82625 Sukisen1981 2019-09-16T11:09:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-breakdown-JSON-data-with-escape-characters-from-events/m-p/482186#M82626 <P>hi @pkol - Did this resolve your issue?</P> Sun, 29 Sep 2019 07:26:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-breakdown-JSON-data-with-escape-characters-from-events/m-p/482186#M82626 Sukisen1981 2019-09-29T07:26:12Z